Law Office Emailing Medical Records: Is It Legal?

The Health Insurance Portability and Accountability Act (HIPAA) outlines the regulations that covered entities and business associates must follow when handling medical records. HIPAA grants individuals the right to access their health information, and medical records can be requested in several ways, including via email. However, there are concerns about HIPAA compliance when it comes to email communication, and violations can result in significant financial penalties. To ensure compliance, law firms often partner with specialized medical records service partners or use medical record retrieval services.

How to request medical records

Requesting your medical records is your right under the law. The Privacy Rule gives you the right to inspect, review, and receive a copy of your medical records and billing records that are held by health plans and healthcare providers covered by the Privacy Rule. Only you or your personal representative has the right to access your records.

Online

If you are an active-duty service member, a veteran, or a Medicare beneficiary, you can see and download some of your health information by clicking on the Blue Button icon on your government health plan or provider's online patient portal.

Via Mail

You can mail a letter to your healthcare provider requesting your medical records. You will need to include the full name, date of birth, patient identification number (PIN), or medical record number (MRN) of the patient whose records are being requested. You will also need to include the full name, address, phone number, and secure fax or secure email address where the provider can send you the records.

Via Phone

You can call your healthcare provider and ask them how to get your health record. Ask for the health information services department or the administrative staff in charge of releasing health records.

In Person

You can visit your healthcare provider and ask them how to get your health record. Again, ask for the health information services department or the administrative staff in charge of releasing health records.

Via Email

Sending protected information via email can be HIPAA compliant, as long as you apply reasonable safeguards and take proper precautions when doing so. Emails should have end-to-end encryption to ensure that only the intended sender and recipient can access them.

Via a Retrieval Partner

You can use a medical record retrieval service such as American Retrieval to help you access your medical records. These services can ensure HIPAA compliance and free up your time to focus on other areas of your business.

Patient consent and HIPAA compliance

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) protects the privacy and security of individuals' identifiable health information. It gives patients the right to access their health information and obtain a copy of their health records. This includes medical records, billing records, payment and claims records, health plan enrollment records, case management records, and other records used by covered entities to make decisions about individuals.

To be HIPAA-compliant when emailing medical records, certain precautions must be taken to avoid unintentional disclosures. For example, checking the email address for accuracy before sending or sending an email alert to the patient for address confirmation. Additionally, sending medical records via email should be done using a secure HIPAA-compliant email application. If a patient requests that medical records be sent via unencrypted email, this request must be granted, but reasonable safeguards should be applied to protect privacy, such as limiting the amount or type of information disclosed.

If a patient is incapacitated or deceased, their next of kin or legal representative may request their medical records on their behalf. The request must be accompanied by documentation proving the signing individual's legal standing to grant access to the records. Attorneys representing patients may also request medical records in writing from the individual physician or healthcare facility. These requests must be signed and may need to be notarized.

It is important to note that while HIPAA allows individuals to receive copies of their PHI by unsecure methods if they prefer, covered entities cannot require individuals to accept unsecure transmission methods to receive their health information. Covered entities must provide individuals with access to their protected health information in the form and format requested if it is readily producible in such a form. If not, it can be provided in a readable hard copy or another format agreed upon by the covered entity and the individual.

Medical record retrieval services

There are several ways to request medical records with a consenting patient that fulfills HIPAA requirements. These include:

• Having the patient submit medical record requests to send to your firm.
• Obtaining signed release forms and handling requests directly or via a retrieval partner.
• Arranging a limited Power of Attorney from the patient for medical record retrieval.

If the patient is incapacitated or deceased, communication will likely be through a next-of-kin family member or legal representative. A request must be accompanied by documentation proving the signing individual's legal standing to grant access to the records.

U.S. Legal Support is one such service that provides comprehensive legal support services, including nationwide medical record retrieval, analysis, and organization compliant with SOC 2 Type 2 and HIPAA regulations. They offer a range of record retrieval services, including medical, business, employment, human resources, personnel, and insurance records. Their team can retrieve both paper and digital records and deliver them in the desired format, including digital copies, hard copies, or a combination of both. They also provide optional analysis and organization services, such as patient demographics reviews, medical summaries, and medical billing summaries.

Lexitas is another experienced provider of medical record retrieval services, with over 40 locations across the United States. They have dedicated hands-on professionals and secure client portals to ensure fast access to the required records. Lexitas customizes its services based on practice areas and case types, offering specialized training for staff handling requests. They also provide detailed status reports and are known for their professionalism and quality service.

Record organisation and digitisation

Record Organisation:

• Obtaining Records: Request medical records from healthcare providers or facilities, ensuring compliance with relevant laws and regulations, such as the Health Insurance Portability and Accountability Act (HIPAA) in the US. Obtain signed release forms and specify the required records to ensure efficient retrieval.
• Centralising Records: Gather all medical records in one place, whether physical or digital. This includes records from various healthcare providers, such as primary care physicians, specialists, hospitals, and pharmacies.
• Categorisation: Sort and categorise records by date, type, and relevance. For instance, create sections for family health history, personal health history, medications, test results, and treatment responses.
• Accessibility: Ensure that records are easily accessible when needed. Keep physical records in a designated, secure location, such as a filing cabinet or binder with labelled dividers. For digital records, use a secure cloud-based storage system or a trusted electronic health records (EHR) platform.
• Backup: Create backup copies of records to prevent loss or damage. Store backups in a separate, secure location or utilise cloud-based solutions.

Record Digitisation:

• Evaluation: Assess your current medical record system to identify areas where digitisation can improve efficiency and security. Identify the types of records to be digitised, such as patient charts, medical histories, and lab results.
• Planning: Develop a comprehensive plan outlining the steps, timeline, budget, and resources required for digitisation. Choose a secure and user-friendly digital record-keeping platform that meets your organisational needs and complies with data security protocols.
• Digitisation: Convert physical records into digital format using optical character recognition (OCR) technology, which enables keyword searches and quick navigation. Ensure the digitisation process is monitored for quality and progress.
• Data Security: Implement robust data security measures to protect patient information from unauthorised access. This includes encryption, password protection, and secure storage protocols.
• Maintenance: Regularly monitor and update your digital record-keeping system to ensure its functionality, security, and compliance with evolving regulations.

By effectively organising and digitising medical records, you can improve efficiency, enhance data security, and facilitate quick access to critical medical information.

Medical record release and access

Patients have the right to access their medical records, and providers are required by law to give patients their records upon request. However, providers may charge a fee for the reasonable costs of copying and mailing the records. This fee cannot be imposed for searching for or retrieving the records. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) gives patients the right to access their medical records and keep their information private.

HIPAA requires that a patient's request to receive their medical records by email be granted, even if the email is unsecure. However, there are ways to send documents securely via email, such as encryption. Emailing medical records is not only more modern but also more secure than faxing or providing paper copies if done properly. Patients can also request that their medical records be sent by mail or fax instead of email.

To request medical records, patients can call or visit their provider and ask how to obtain their health record. They can also submit a request through their provider's patient portal, by email, or by mailing or faxing a letter to their provider. The request must be made in writing and should include the patient's name, date of birth, patient identification number, and medical record number. If the records are to be sent to a third party, the patient should provide the name and address of that individual. The patient may also be required to present identification to verify their identity and prevent unauthorized access to their records.

If a patient's request for medical records is denied, the provider must provide a form explaining the appeals process. The patient can then file a written appeal with the appropriate state health department. If a patient believes the information in their medical records is incorrect, they can request a change or amendment to their record.

Frequently asked questions